Linux auditctl used with -D to delete all audit rules

Flags auditctl -D executions that delete all audit rules and watchers on Linux.

FreeUnreviewedSigmahighv1

linux-auditctl-used-with-d-to-delete-all-audit-rules-bed26dea

title: Linux auditctl used with -D to delete all audit rules
id: 27c1ec08-9d91-4e68-bbc1-55216d8e5b03
status: experimental
description: This rule matches process executions where the binary name ends with /auditctl and the command line contains the -D parameter, indicating deletion of all configured audit rules. Attackers may remove audit monitoring to reduce visibility into their actions and hinder later investigations. The detection relies on Linux process creation telemetry including the executable path and full command line.
references:
  - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012
  - https://linux.die.net/man/8/auditct
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_auditctl_clear_rules.yml
author: Mohamed LAKRI, Huntrule Team
date: 2025-10-17
tags:
  - attack.defense-impairment
  - attack.t1685.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /auditctl
    CommandLine|re: -D
  condition: selection
falsepositives:
  - An administrator troubleshooting. Investigate all attempts.
level: high
license: DRL-1.1
related:
  - id: bed26dea-4525-47f4-b24a-76e30e44ffb0
    type: derived

What it detects

This rule matches process executions where the binary name ends with /auditctl and the command line contains the -D parameter, indicating deletion of all configured audit rules. Attackers may remove audit monitoring to reduce visibility into their actions and hinder later investigations. The detection relies on Linux process creation telemetry including the executable path and full command line.

Known false positives

An administrator troubleshooting. Investigate all attempts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.